Sub-processors
Last updated: September 6, 2026
This page lists the sub-processors Prozly engages to process Customer Data on behalf of business customers. It forms part of our Data Processing Agreement as Annex 3. We announce intended additions or replacements on this page at least 30 days before a new sub-processor processes Customer Data; to subscribe to change notifications, e-mail legal@prozly.ai.
Supabase
Supabase, Inc. (USA)
Purpose: Database, authentication, and file storage for the application.
Data: Account data, workspace content and drafts, uploaded media and documents, connection tokens, usage events.
Location / safeguards: Data stored in the EU (Frankfurt, AWS eu-central-1); EU–U.S. Data Privacy Framework / SCCs for support access.
Vercel
Vercel Inc. (USA)
Purpose: Application hosting, serverless compute, scheduled jobs.
Data: All data transiting the application; request logs and IP addresses.
Location / safeguards: USA/global; EU–U.S. Data Privacy Framework.
OpenAI
OpenAI, L.P. / OpenAI Ireland Ltd
Purpose: AI text generation, embeddings, image generation, audio transcription.
Data: Prompts and AI inputs derived from workspace content (drafts, brand voice, source excerpts, uploaded documents, voice-note audio).
Location / safeguards: USA; EU–U.S. Data Privacy Framework / SCCs. API data is not used to train OpenAI models..
Google (Gemini API, YouTube Data API)
Google Ireland Ltd / Google LLC
Purpose: AI image and infographic generation; ingestion of YouTube sources connected by the customer.
Data: Image prompts and reference images; YouTube channel/video identifiers configured by the customer.
Location / safeguards: USA/global; EU–U.S. Data Privacy Framework / SCCs.
Microsoft Azure Communication Services
Microsoft Ireland Operations Ltd
Purpose: Transactional e-mail (invites, digests, billing notices).
Data: E-mail addresses and e-mail content (may include content summaries in digests).
Location / safeguards: EU / EU Data Boundary; EU–U.S. Data Privacy Framework / SCCs.
Stripe
Stripe Payments Europe, Ltd. (Ireland)
Purpose: Payment processing, subscriptions, invoicing.
Data: Billing identity, subscription and payment data (card data is processed by Stripe only).
Location / safeguards: EU/USA; EU–U.S. Data Privacy Framework / SCCs.
Sentry
Functional Software, Inc. (USA)
Purpose: Error monitoring and performance diagnostics.
Data: Error reports and technical context (request metadata, workspace identifiers); session replays with text masked and media blocked.
Location / safeguards: USA; EU–U.S. Data Privacy Framework / SCCs.
Brave Search API
Brave Software, Inc. (USA)
Purpose: News and web-mention search for source discovery and brand assessment.
Data: Search queries derived from workspace settings (e.g. brand, competitor, or topic names); no workspace content is stored by Brave.
Location / safeguards: USA; SCCs.
Telegram
Telegram Messenger Inc.
Purpose: Optional messaging channel: create drafts by sending text or voice notes to the Prozly bot.
Data: Telegram user ID and name, messages and voice notes sent to the bot, bot replies.
Location / safeguards: Engaged only when the customer actively connects the Telegram channel; transfer occurs as part of the customer-initiated integration.
Platforms you connect (not sub-processors)
When you connect social platforms — e.g. LinkedIn (Microsoft) or Instagram (Meta) — and publish content there, we transmit your content and use your OAuth tokens on your instruction. These platforms act on the basis of your own relationship with them and are recipients on your instruction, not our sub-processors. The same applies to websites, RSS feeds, and YouTube channels you configure as sources: we retrieve them on your instruction.